Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and net/base/filename_util.cc.

The version of Google Chrome for Android on the remote mobile host is prior to 50.0.2661.102 and thus unpatched for a flaw in the 'FileURLToFilePath()' function in 'net/base/filename_util.cc' that allows traversing outside of a restricted path.  The issue is due to the program not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the file scheme.  This may allow an attacker to have an unspecified impact.

Google Chrome Releases reports :

5 security fixes in this release, including :

- [605766] High CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski.

- [605910] High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski.

- [606115] High CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.

- [578882] Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.

- [586657] Medium CVE-2016-1671: Directory traversal using the file scheme on Android. Credit to Jann Horn.

The remote host is affected by the vulnerability described in GLSA-201605-02 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote macOS host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_05_stable-channel-update advisory.

  - The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before     50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote     attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via     crafted JavaScript code. (CVE-2016-1669)

  - The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in     Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-     adoption operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web     site. (CVE-2016-1667)

  - The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink,     as used in Google Chrome before 50.0.2661.102, uses an improper creation context, which allows remote     attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-1668)

  - Race condition in the ResourceDispatcherHostImpl::BeginRequest function in     content/browser/loader/resource_dispatcher_host_impl.cc in Google Chrome before 50.0.2661.102 allows     remote attackers to make arbitrary HTTP requests by leveraging access to a renderer process and reusing a     request ID. (CVE-2016-1670)

  - Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which     allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and     net/base/filename_util.cc. (CVE-2016-1671)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_05_stable-channel-update advisory.

  - The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before     50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote     attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via     crafted JavaScript code. (CVE-2016-1669)

  - The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in     Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-     adoption operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web     site. (CVE-2016-1667)

  - The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink,     as used in Google Chrome before 50.0.2661.102, uses an improper creation context, which allows remote     attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-1668)

  - Race condition in the ResourceDispatcherHostImpl::BeginRequest function in     content/browser/loader/resource_dispatcher_host_impl.cc in Google Chrome before 50.0.2661.102 allows     remote attackers to make arbitrary HTTP requests by leveraging access to a renderer process and reusing a     request ID. (CVE-2016-1670)

  - Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which     allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and     net/base/filename_util.cc. (CVE-2016-1671)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
9375	Google Chrome for Android < 50.0.2661.102 Directory Traversal	Nessus Network Monitor	Mobile Devices	medium
91371	FreeBSD : chromium -- multiple vulnerabilities (4dfafa16-24ba-11e6-bd31-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
91176	GLSA-201605-02 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91129	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
91128	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-1671

high

Tenable Plugins

medium

high

critical

high

high